[Openid-specs-fapi] FAPI part 2: Signaling request_uri is one-time use

[Vladimir Dzhuvinov]

Hi,

Part 2 of the FAPI specifies an endpoint where clients can upload their
request JWTs. The spec says that the request URI which the server
creates on behalf of the client should be preferably one-time use. At
present there is a way to signal request URI expiration (exp), but not
when the URI is one-time use:

http://openid.net/specs/openid-financial-api-part-2.html#successful-response

I wonder how this information can be conveyed to the client?

I suppose "exp" and one-time use are not mutually exclusive?


Vladimir


PS: The strings in the JSON example are single quoted, for valid JSON I
believe they should have double quotes.

-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3711 bytes
Desc: S/MIME Cryptographic Signature
URL: <http://lists.openid.net/pipermail/openid-specs-fapi/attachments/20170727/b522205b/attachment.p7s>